Elvith Ma'for

Former Reddfugee, found a new home on feddit.de. Server errors made me switch to discuss.tchncs.de. Now finally @ home on feddit.org.

Likes music, tech, programming, board games and video games. Oh… and coffee, lots of coffee!

I � Unicode!

  • 11 Posts
  • 368 Comments
Joined 1 年前
cake
Cake day: 2024年6月21日

help-circle




  • You can disable UAC (thinking practical, not necessarily security minded - but for an auto login w/o password, what’s security?)

    Popups: yes. But then you’d need to actively use other software besides steam. Why would you do that, if using only a controller? Also that can happen in Linux, too. If you mean those desktop notifications - those should be silenced automagically when running games.

    For the logoff or shutdown: Set or createHKEY_CURRENT_USER\Control Panel\Desktop\AutoEndTasks to 1 to auto kill hanging/not ending processes automagically. Also you can use WaitToKillAppTimeout there to define how long windows should wait before killing the processes (in milliseconds).

    And regarding bitlocker after a bios update: why would you use bitlocker on such a machine (auto login on boot which would allow access to all files anyways)? Anyways, set or create HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\BitLocker\PreventDeviceEncryption to 1 to prevent bitlocker from running after an upgrade. With Pro, you could also leverage GPOs for that.

    At least for the new Steam Gamepad they announced trackpads to be able to control the mouse with the gamepad, so clicking away a popup or sich shouldn’t be a problem.








  • Some things are harder, but for starters a few ideas:

    • Either check that the reported positions of players, their movement speed, etc are consistent to what the game would allow you to do (don’t fly, don’t go faster, don’t go through walls,…) or only accept player input, process it server side and then send positions etc back to the client. (You can do some local interpolation, but the server wins, when there’s a miss match). That should get rid of flying, no clip, teleportation, evasion of projectiles, … You can also analyze the inputs for abnormal behavior like the precision with which you aim for the (center of) the head, aiming through walls, etc.

    • Do all hitscan and projectiles etc. server side. Never let clients report that they’re hitting other players. This is calculated on the server.

    • Do only report other player positions when they’re on screen or almost on screen. If the client doesn’t know where the enemies are, wallhacks are impossible or harder (note that some information may be transferred to the client for the sake of spatial audio etc!)

    And so on. Do not, never ever, rely on client side data or validation. If a cheat program can alter the client, it can alter the data it sends. How do you ensure, that the client is actually official and “your code”, when it can tell you anything it wants to tell you? You can only make it harder for others to impersonate your client, but never impossible. Especially on PC, when you can execute just about any code you want?







  • No, that’s just another hypothetical app that you’re using a reverse proxy for. I just included it to show how you can also set settings for a single subdomain/reverse proxy entry that isn’t used globally on all domains that get served. I used a hypothetical REST API that needs a CORS Header that other apps don’t need (or maybe serve themselves).

    admin off disables Caddy’s admin interface (which shouldn’t be public and if you’re using config files this usually isn’t needed. So just a bit of gardening)

    servers sets some general server options.

    and then I just inserted several blocks that each define a reverse proxy to a different app / backend to show that you can just dump them all in a single Caddyfile. And the last example to show that you can set specific settings only for a specific subdomain instead of globally. As I set headers mostly used by REST APIs, I just called that api.example.com instead of app3.example.com.



  • If you like, I can send you an example of the Caddyfiles, that I’m using (I used the import directive to split every service into its own Caddyfiles, you could just copy and paste everything in the same file). It will take a few hours until I get home, though.

    But basically you can just put every subdomain and it’s target in a separate block and the add some things globally (e.g. passing the original IP, switching off the admin API of Caddy,…)

    Something like this should work:

    
    admin off 
    
    servers {
    		client_ip_headers X-Forwarded-For X-Real-IP
    }
    
    app.example.com {
        reverse_proxy 127.0.0.1:8080
    }
    
    app2.example.com {
        reverse_proxy 127.0.0.1:8081
    }
    
    api.example.com {
        reverse_proxy 127.0.0.1:8082
        header {
            Access-Control-Allow-Methods "GET, OPTIONS"
            Access-Control-Allow-Origin "*"
        }
    }